[gdb] Fix heap-buffer-overflow in args_complete_p
PR gdb/33754 reports a heap-buffer-overflow args_complete_p, while checking
the while condition:
...
while (*input != '\0')
{
input = skip_spaces (input);
...
++input;
}
...
The problem can be reproduced by calling args_complete_p (" "). The following
happens:
- at function entry, input == " "
- the while loop is entered
- after skip_spaces, input == ""
- after the ++input at the end of the loop body, input points past the
terminating '\0'
- while checking the while condition, *input does an out-of-bound access.
Add a unit test exercising this minimal example, fix this by checking
input after skip_spaces, and add an assert to detect the heap-buffer-overflow
without Address Sanitizer.
Another heap-buffer-overflow can be found by calling args_complete_p ("\"\\").
In this case, the following happens:
- at function entry, input == "\"\\"
- the while loop is entered
- dquote is set to true and input == "\\"
- the while loop is entered a second time
- the condition *input == '\\' && strchr ("\"\\", *(input + 1)) != nullptr
evaluates to true (which is not trivial to understand, because the char
found in the string "\"\\" is '\0'), leading to two increments of input,
again making input point past the terminating '\0'.
Fix this by checking for *(input + 1) == '\0', and likewise add a unit test.
Tested on x86_64-linux.
Approved-By: Tom Tromey <tom@tromey.com>
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=33754
1 file changed